The CVSS 7.2 score on this Eventin LFI misrepresents the actual threat landscape. This isn't a standalone remote code execution path — it's a post-authentication reconnaissance tool that collapses the privilege escalation model CVSS assumes.
WordPress editors already have the ability to edit theme and plugin files directly through the admin interface in most default configurations. The traditional LFI risk model — where file inclusion leads to RCE by writing a shell — doesn't apply here in the standard way, because an editor can often achieve code execution through legitimate means. What this vulnerability actually provides is targeted file access that bypasses WordPress's file-editing audit trails: reading wp-config.php to harvest database credentials, accessing files outside the webroot that the editor UI restricts, or locating configuration artifacts on shared hosting that reveal other vulnerable applications.
The 'template path' parameter name is the analytical crux — this wasn't accidental path handling; it's a feature that shipped with intended flexibility and no boundary enforcement. The question you should grapple with is whether this LFI's real danger is in server-level compromise scenarios (shared hosting, adjacent apps, credential harvesting) rather than the direct RCE path that the CVSS score implicitly weights.
Your priorities: First, determine what the 4.1.20 patch actually changed — allowlist validation, capability-based access checks, or feature removal. Each produces a different residual risk profile. Second, on shared hosting or multi-site WordPress, assume an editor in one site can reach configuration files belonging to adjacent sites unless proven otherwise. Third, recognize that any file read via this LFI leaves no WordPress audit trail — it's a read operation, not a logged edit. Monitor server-level filesystem access logs instead. The CVSS score weights execution; the actual exploitation pattern you need to defend against is credential exfiltration that is operationally invisible to WordPress-centric security monitoring.